news
WP2Shell Threatens WordPress Installations
-
SANS ☛ WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited.
-
Security Week ☛ WP2Shell WordPress Vulnerabilities Exploited in the Wild
The vulnerabilities have been dubbed WP2Shell and they are officially tracked as CVE-2026-60137 and CVE-2026-63030.
According to Searchlight Cyber, whose researchers discovered the flaws, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected.
-
Dark Reading ☛ 'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.
-
SQ Magazine ☛ WordPress WP2Shell Flaws Under Active Exploitation
1. The WP2Shell bugs were fixed, according to WordPress, on July 17, 2026, shipping versions 6.9.5 and 7.0.2 to close both holes.
2. Chaining the two bugs lets an attacker achieve unauthenticated remote code execution on affected WordPress websites, per NVD’s vulnerability record.